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Preface 


Since  its  founding  in  1952,  the  Advisory  Group  for  Aerospace  Research  and  Development  has  published,  formerly  through 
the  Flight  Mechanics  Panel  and  latterly  through  the  Flight  Vehicle  Integration  Panel,  a  number  of  standard  texts  in  the  field  of 
flight  testing.  The  original  Flight  Test  Manual  was  published  in  the  years  1954  to  1956,  and  was  divided  into  four  volumes: 

1  Performance 

2  Stability  and  Control 

3  Instrumentation  Catalog,  and 

4  Instrumentation  Systems. 

To  cover  developments  in  the  field  of  flight  test  instrumentation,  the  Flight  Test  Instrumentation  Group  of  the  Flight 
Mechanics  Panel  was  established  in  1968  and  updated  Volumes  3  and  4  of  the  Flight  Test  Manual  via  publications  in  the 
Flight  Test  Instrumentation  Series,  AGARDograph  160. 

In  1978,  the  Flight  Mechanics  Panel  decided  that  further  specialist  monographs  should  be  published  covering  aspects  of 
Volumes  1  and  2  of  the  original  Flight  Test  Manual,  including  the  flight  testing  of  aircraft  systems.  In  March  1981,  the  Flight 
Test  Techniques  Group  was  established  to  carry  out  this  task,  the  monographs  of  this  series  (with  the  exception  of  AG  237 
which  was  separately  numbered)  being  published  as  individually  numbered  volumes  of  AGARDograph  300. 

In  1993,  the  Flight  Test  Techniques  Group,  which  had  by  then  assumed  responsibility  for  AGARDographs  in  both  the  160 
and  300  Series,  was  changed  from  a  Working  Group  (WG-1 1)  to  a  committee  of  the  Flight  Mechanics  Panel  (the  Flight  Test 
Editorial  Committee).  In  1994,  the  Flight  Mechanics  Panel  itself  was  disbanded,  most  of  its  functions  (including 
responsibility  for  the  Flight  Test  Editorial  Committee)  being  assumed  by  the  new  Flight  Vehicle  Integration  Panel. 

At  the  end  of  each  volume  in  the  AGARDograph  160  and  300  Series  an  Annex  gives  a  list  of  volumes  published  in  the  Flight 
Test  Instrumentation  Series  and  in  the  Flight  Test  Techniques  Series. 

The  present  Volume  (Vol.  12  of  AGARDograph  300)  is  entitled  “The  Principles  of  Flight  Test  Assessment  of  Flight-Safety- 
Critical  Systems  in  Helicopters”, 

Modem  helicopters  usually  incorporate  many  engineering  systems  (including  pilot-aiding  systems  such  as  autostabilisers  and 
flight  directors)  which  are  essential  to  the  safe  and  effective  use  of  the  helicopter.  Where  the  helicopter  can  be  endangered  by 
failure  of  a  system  (or  of  one  of  its  units),  that  system  is  termed  flight-safety-critical.  In  general,  the  use  of  those  systems 
should  not  incur  a  higher  probability  of  hazard  to  the  helicopter  than  that  considered  acceptable  from  considerations  of 
structural  or  mechanical  failure. 

In  assessing  the  suitability  of  a  helicopter  for  its  intended  mission(s),  it  has  become  increasingly  important  to  consider  the 
effects  of  the  various  systems  provided.  In  particular,  assessments  of  the  implications  of  systems  performance  and  failures 
derived  from  calculation  and  ground  tests  should  be  validated  by  flight  tests.  This  paper  seeks  to  establish  the  general 
principles  applicable  to  the  testing  in  flight  of  any  flight-safety-critical  system,  with  emphasis  on  certification  rather  than 
system  development.  It  does  not  deal  with  the  testing  of  particular  systems,  but  it  is  hoped  that  readers  will  find  the  principles 
described  readily  applicable  to  specific  cases. 
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Depuis  sa  creation  en  1952,  le  Groupe  consultatif  pour  la  recherche  et  les  realisations  aerospatiales  (AGARD),  a  publie, 
autrefois  par  Fintermediaire  du  Panel  de  la  mecanique  du  vol,  et  recemment  par  celui  du  Panel  conception  integree  des 
vehicules  spatiaux,  un  certain  nombre  de  textes  normatifs  dans  le  domaine  des  essais  en  vol.  Le  premier  manuel  d’Essai  en 
vol  a  ete  publie  entre  les  annees  1954  et  1956.  Ce  manuel  est  compose  de  quatre  volumes,  a  savoir: 

1  Performances 

2  Stabilite  d’instrumentation 

3  Catalogue  d’instrumentation 

4  Systemes  d’instrumentation 

Afin  de  couvrir  les  developpements  dans  le  domaine  de  F instrumentation  des  essais  en  vol,  le  Groupe  de  travail  sur 
1 ’instrumentation  des  essais  en  vol  du  Panel  de  la  mecanique  du  vol  a  ete  cree  en  1968  et  les  volumes  3  et  4  du  Manuel  des 
essais  en  vol,  sous  la  forme  de  la  serie  AGARDographie  160  sur  F  Instrumentation  des  essais  en  vol  ont  ete  mis  a  jour. 

En  1978,  le  Panel  de  la  mecanique  du  vol  a  decide  d’editer  d’autres  monographies  specialisees,  couvrant  les  volumes  1  et  2 
du  Manuel  des  essais  en  vol  initial,  y  compris  les  essais  en  vol  des  systemes  de  bord.  Au  mois  de  mars  1981,  le  Groupe  de 
travail  sur  les  techniques  des  essais  en  vol  a  ete  constitue  pour  mener  a  bien  cette  tache.  Les  monographies  dans  cette  serie,  a 
F exception  de  FAG  237  qui  porte  un  numero  distinct,  sont  numerotees  individuellement  dans  la  serie  AG  300. 

En  1993,  le  Groupe  de  travail  sur  les  techniques  des  essais  en  vol,  qui  dans  Fintervalle,  avait  accepte  la  responsabilite  des 
AGARDographies  dans  la  serie  160  et  dans  la  serie  300,  a  change  d’ appellation;  le  Groupe  de  travail  WG-1 1  est  devenu  un 
comite  du  Panel  de  la  mecanique  du  vol  (le  Comite  de  redaction  des  essais  en  vol).  En  1994,  le  Panel  de  la  mecanique  du  vol 
lui-meme  a  ete  dissout  et  la  plupart  de  ses  fonctions  (y  compris  la  responsabilite  du  Comite  de  redaction  des  essais  en  vol)  ont 
6t6  reprises  par  le  nouveau  Panel  conception  integree  des  vehicules  aerospatiaux. 

A  la  fin  de  chacun  des  volumes  dans  les  series  160  et  300,  une  annexe  donne  la  liste  des  volumes  publics  dans  la  serie 
Instrumentation  des  essais  en  vol  et  dans  la  serie  Techniques  des  essais  en  vol. 

Le  present  volume  (Vol  12  de  F AGARDographie  300)  est  intitule  «Les  Principes  de  Fevaluation,  dans  le  cadre  des  essais  en 
vol,  des  systemes  indispensables  a  la  securite  de  vol  des  helicopteres». 

Normalement,  les  helicopteres  modemes  int^grent  un  certain  nombre  de  systemes  technogeniques  (y  compris  des  systemes 
d’aide  au  pilote  tels  que  les  centrales  de  stabilisation  et  les  directeurs  de  vol)  qui  sont  indispensables  a  Femploi  efficace  de  cet 
aeronef  dans  les  conditions  de  securite  requises.  Toutes  les  fois  que  Fhelicoptere  risque  d’etre  mis  en  danger  suite  a  une  panne 
d’un  systeme  (ou  de  Fun  de  ses  elements)  le  systeme  est  designe  ^indispensable  a  la  securite  de  vol».  En  general,  Femploi 
de  ces  systemes  ne  devrait  entrainer  une  probabilite  de  dommages  plus  grande  que  celle  consideree  comme  etant  acceptable 
dans  le  cas  de  defaillances  mecaniques  ou  structurales. 

Lorsqu’il  s’agit  d’evaluer  F  aptitude  d’un  helicoptere  donne  vis-a-vis  de  sa  future  mission  ou  missions,  il  devient  de  plus  en 
plus  important  de  considerer  F  impact  des  differents  systemes  prevus.  En  particulier,  les  evaluations  des  consequences  des 
pannes  et  des  performances  des  systemes,  etablies  sur  la  base  de  calculs  et  d’ essais  au  sol,  doivent  etre  validees  par  des  essais 
en  vol.  Cette  communication  a  pour  objet  d’etablir  les  principes  generaux  applicables  lors  des  essais  en  vol  de  tout 
systeme  indispensable  a  la  securite  de  vol,  en  mettant  F  accent  sur  F homologation  de  preference  au  developpement  des 
systemes.  Elle  ne  traite  pas  d’ essais  de  systemes  specifiques,  mais  il  est  a  souhaiter  que  le  lecteur  pourra  appliquer  les 
principes  y  decrits  a  des  cas  specifiques  sans  trop  de  difficultes. 
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1.  INTRODUCTION  OF  BASIC 
PRINCIPLES 

1.1  Basic  Ainvoilhiness  Principles 

It  is  taken  as  axiomatic  that  helicopters  must 
operate  safely  and  effectively.  Helicopters  are 
mechanical  devices  and,  in  mechanical  terms, 
the  quest  for  greater  effectiveness  (e.g. 
enhanced  capability  in  respect  of  mass,  speed, 
manoeuvrability  and  acceleration)  is 
constrained  by  safety  considerations  (e.g.  of 
mechanical  and  structural  integrity).  Much 
development  effort  goes  into  extending  the 
flight  envelope,  without  infringing  mechanical 
and  structural  stress  limits,  in  order  to  provide 
both  the  structural  and  mechanical 
"performance"  demanded  by  the  helicopter's 
role(s)  and  an  acceptable  level  of  "safety". 

However,  failures  can  occur  and  it  has  been 
necessary  to  recognise  this  fact  in  the  way 
helicopters  are  operated  and  maintained.  If  the 
structural  or  mechanical  integrity  is  impaired 
by  a  failure  the  result  may  be; 

*  immediately  critical  (eg  if  a  rotor  blade 
fails), 

*  critical  in  the  longer  term  (eg  if  cracking 
occurs  in  the  fuselage)  or,  perhaps, 

*  not  critical  at  all  (eg  if  some 
non-structural  fairing  starts  to  crack,  but  does 
not  detach) 

Failures  that  are  immediately  critical  and 
would  entail  loss  of  the  helicopter  must  not  be 
allowed  to  happen  in  Service  use.  The  relevant 
components  (e.g.  rotor  heads,  blades,  and 
gearboxes)  are  therefore  subjected  to  extensive 
testing  to  determine  their  Safe  Lives  so  that,  in 
Service,  they  can  be  changed  before  they  fail. 
Other  components  whose  failure  is  not 
immediately  critical  are  monitored  and 
rectified  as  required,  the  urgency  of  the  repair 
depending  upon  the  criticality  of  the  failure. 
This  classification  of  failure  effects,  and  their 
treatment,  is  illustrated  in  the  left  hand  side  of 
Figure  1. 

1.2  Application  to  Systems 

A  similar  reasoning  can  be  applied  to  many  of 
the  pilot-aiding  (and  some  other)  systems  that 
are  increasingly  used  in  most  helicopters, 
where  the  flight  safety  of  the  helicopter 
requires  not  only  the  proper  performance  of  the 


system  when  operating  correctly,  but  also  the 
ability  to  survive  failures  of  the  system.  Such 
systems  are  referred  to  in  this  document  as 
being  'flight-  safety-critical*.  Testing  is 
necessary  to  establish; 

*  the  envelope  of  conditions  within  which 
the  system  behaves  correctly  (ie  system 
performance  tests),  and 

*  what  happens  when  failures  occur  within 
the  systems  (ie  system  failuie  tests). 

1.3  System  Perfonnance  Testing 

The  system  performance  tests  actually  carried 
out  will  depend,  of  course,  upon  the  nature  of 
the  system.  For  example,  a  flight  path 
controller  requires  different  tests  from  a  rotor 
speed  governor.  However,  fundamental  to  all 
such  testing  is  the  principle  of  establishing  the 
envelope  within  which  the  system  behaves 
adequately.  It  may  be  desirable  for  a  system 
to  operate  over  the  entire  helicopter  flight 
envelope  but,  if  the  system  performance  is 
inadequate,  it  may  be  necessary  to  curtail  the 
flight  envelope  to  match  the  system  capability. 
Equally,  a  system  may  be  required  to  operate 
only  over  part  of  the  helicopter  total  envelope 
(an  automatic  approach  system,  for  example) 
but,  again,  it  is  necessary  to  define  precisely 
the  range  of  conditions  within  which  the 
system  will  do  its  job  properly.  In  assessing 
the  adequacy  of  a  dynamic  system  there  are 
two  fundamental  properties  that  need  to  be 
established.  These  are  the  authority  and  the 
response  of  the  system,  which  are  analogous, 
in  flying  qualities  terms,  to  the  range  of 
control  available  and  the  responsiveness  of  the 
aircraft  to  the  controls. 

1.4  System  Failure  Testing 

Although  an  analogy  can  be  drawn  with  the 
testing  of  the  structural  and  mechanical 
elements  of  the  helicopter  (as  illustrated  in  the 
right  hand  side  of  Figure  1),  a  special  category 
arises  in  the  failure  testing  of  systems  in  which 
failure  can  give  rise  to  a  disturbance  to  the 
flight  path.  This  is  because  corrective  action 
must  be  provided  by  the  pilot  rather  than  by 
the  designer  or  by  the  maintenance  crews  on 
the  ground.  The  following  systems  are  typical 
of  those  in  which  piloting  action  is  required  to 
counter  the  effects  of  failure; 

*  Flying  controls. 
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*  Engine  and  fuel  control  systems  and 
rotorspeed  governors. 

*  Automatic  stabilizers. 

*  Flight  path  control  systems. 

*  Cockpit  displays,  especially  attitude 
displays,  flight  directors  and  weapon  aiming 
displays  intended  to  provide  orientation  or 
manoeuvre  guidance. 

*  Systems  having  aerodynamic  effects, 
such  as  external  flotation  bags,  de-icing 
systems,  hoists,  armament,  or  sling  systems. 

Clearly,  a  helicopter  suffering  a  failure  of  such 
a  system  should  be  able  to  survive  both  the 
moment  of  failure  and  a  subsequent  period 
sufficient  to  allow  the  flight  to  be  completed 
or  safely  terminated. 

1.5  Principles  of  Failure  Testing 
The  test  methods  developed  piecemeal  to  deal 
with  specific,  relatively  simple,  systems  have 
proved  acceptable  in  the  past.  However,  the 
increasing  number  and  complexity  of 
safety-critical  systems  require  a  more  rigorous 
and  systematic  approach.  In  all  such  testing 
there  are  fundamental  principles  that  need  to 
be  recognised,  and  the  primaiy  objective  of 
this  paper  is  to  define  these  principles,  and 
develop  a  set  of  rules  that  can  be  applied  to 
the  failure  testing  of  any  safety-critical 
helicopter  system  which  relies  on  pilot 
intervention  in  the  event  of  malfunction. 

The  flight  test  programme  must  be  sufficiently 
rigorous  to  ensure  that  the  helicopter's  failure 
characteristics  are  identified  and  investigated 
thoroughly,  so  that  its  safety  and  operational 
effectiveness  in  Service  use  can  be  maximised. 
At  the  same  time,  that  programme  must  be 
conducted  without  unreasonable  hazard  to  the 
helicopter.  The  following  paragraphs  introduce 
(and  offer  some  initial  guidance  on)  the 
principal  aspects  that  must  be  considered. 

1.5.1  Specifications. 

The  design  of  a  helicopter  is  governed  by  a 
series  of  general  and  particular  specifications, 
such  as; 

*  Specifications  for  individual  systems. 

*  Specification  for  the  helicopter. 

*  General  specification  of  required  flying 
qualities,  such  as  those  contained  in 
References  1,  2  and  3. 


Clearly,  the  tests  conducted  (and  the  criteria  of 
acceptability  applied  to  the  results)  must  reflect 
the  specifications  to  which  the  helicopter  has 
been  designed  and  built.  However,  it  should 
be  noted  that,  because  of  the  complexities  of 
the  man/machine  interface,  it  is  impossible  to 
write  a  specification  in  respect  of  some 
aspects,  such  as  flying  qualities,  that  will 
guarantee  a  satisfactory  machine.'  For  this 
reason,  specifications  dealing  with  such  matters 
are  often  better  regarded  as  being  advisory 
rather  than  mandatory,  and  it  is  not  unusual  for 
a  feature  which  does  not  quite  meet  the 
applicable  specification  requirement  to  be 
judged  acceptable  (and  vice  versa). 

1.5.2  Identification  and  Oassification  of 
Failures. 

A  preliminary  theoretical  study  of  each 
potentially  flight-safety-critical  system  should 
be  made  to  identify  all  possible  failures,  their 
consequences  for  the  helicopter,  and  their 
probabilities  of  occurrence.  In  conducting  this 
study  it  should  be  noted  that: 

*  Any  system  failure  that  affects  the  flight 
path  is  potentially  flight-safety-critical. 

*  A  helicopter  having  suffered  an  initial 
failure  is  then  in  a  'degraded'  condition  which 
may  present  a  new  situation  for  the  survival  of 
further  failures. 

*  Failures  whose  probability  of  occurrence 
can  be  shown  to  be  sufficiently  low  can  be 
disregarded. 

1.5.3  Criteria  of  Acceptability. 

In  conducting  the  preliminary  theoretical  study, 
and  when  planning  the  flight  tests,  it  is 
necessary  to  adopt  some  general  criteria  of 
acceptability,  such  as: 

*  Definition  of  the  failure  rate  that  is 
accepted  as  being  so  low  that  such  failures  can 
be  excluded  from  consideration. 

*  Definition  of  the  failure  rates  that  are 
acceptable  for  various  classes  of  failure,  e  g. 
those  whose  consequences  are,  for  instance, 
innocuous,  mission  affecting,  safety  reducing, 
or  dangerous.  (This  is  a  difficult  topic:  it  is 
dealt  with  in  Reference  2  but,  inevitably,  falls 
back  on  the  procuring  agency  when  the  most 
critical  types  of  failure  are  being  considered.) 

*  The  helicopter  must  remain  controllable 
after  surviving  a  failure  so  that  the  flight  may 
be  continued  or  terminated  in  safety. 


3 


*  A  system  failure  may  be  regarded  as 
survivable  if  it  is  considered  that  a  typical 
experienced  pilot,  unwarned  and  performing 
his  normal  tasks,  could  intervene  successfully 
to  counter  the  failure. 

*  If  it  is  accepted  that  the  pilot  cannot 
always  intervene  successfully,  then  the 
probability  of  his  being  unable  to  do  so  must 
be  compatible  with  the  acceptable  loss  rate. 

1.5.4  Preliminary  Ground  Tests. 

Where  available,  rigs  and/or  simulators  should 
be  used  to  refine  the  theoretical  studies  of 
potential  failure  cases  and  their  recovery,  and 
thus  enhance  the  confidence  with  which  "worst 
cases"  are  identified  for  flight  test. 

(Conversely,  if  the  results  of  the  flight  tests 
show  that  the  fidelity  of  the  rig/simulator  is 
adequate,  consideration  should  be  given  to 
using  it  for  interactive  investigation  of  failures 
which  it  would  be  impracticable  to  conduct  in 
flight:  an  example  might  be  simultaneous 
failure  of  two  channels,  whose  probability  of 
occurrence  is  estimated  to  be  too  high  to 
discount.) 

1.5.5  Scope  of  Flight  Tests. 

While  the  scope  of  the  flight  tests  will  depend 
on  the  details  of  the  particular  system  under 
investigation,  the  following  must  always  be 
borne  in  mind: 

*  The  test  programme  must  include  the 
critical  failures,  although  they  should  be 
examined  initially  in  benign  conditions. 

*  The  programme  should  establish  the 
most  adverse  conditions  in  which  a  critical 
failure  remains  survivable. 

*  The  flight  tests  of  failures  should  aim  at 
being  representative  of  real  operations,  and 
avoid  being  a  'circus  trick'  performable  only  by 
a  highly  skilled  test  pilot  currently  practised  in 
failure  testing. 

2.  THE  PRINCIPLES  IN  OPERATION 

2.1  Analysis  of  Failures  by  Causes. 

For  flight  test  purposes,  it  is  necessary  to 
assess  failures  in  terms  of  their  effect  on  the 
helicopter,  although  those  effects  are  caused  by 
some  malfunction  within  a  system.  For 
example,  a  nose  down  divergence  could  be 
caused  by  a  control  system  actuator  being 
driven  to  full  travel  as  a  result  of  the  failure  of 


a  component  in  the  electrical  circuit.  Hence  in 
analysing  the  failures  that  can  occur  within  a 
system  it  is  not  unreasonable  to  ask  oneself  the 
question  "what  is  the  worst  that  this  system 
can  do  to  the  helicopter?".  The  response 
might  be,  for  an  autostabiliser  system,  that  the 
maximum  effect  that  the  system  can  produce  is 
a  full-stroke  maximum-rate  runaway  of  any  of 
its  actuators.  The  system  might  then  be 
judged  satisfactory  from  the  failure  point  of 
view  if  it  were  to  be  shown  by  flight  test  that, 
following  an  actuator  runaway,  the  ensuing 
manoeuvre  could  be  survived.  This  has  been  a 
traditional  way  of  treating  autostabiliser  and 
autopilot  systems,  and  is  still  the  basis  of 
much  engine  failure  testing. 

However,  this  method  becomes  less  than 
satisfactory  as  systems  become  more  and  more 
complex  and  failures  can  produce  aberrant 
behaviour  in  more  than  one  channel,  or  over  a 
period  of  time.  It  is  then  necessary  to 
examine,  by  detailed  theoretical  analysis,  the 
consequences  of  failure  of  each  component  in 
order  to  identify  those  whose  failure  can 
adversely  affect  the  system.  This  procedure  is, 
of  course,  well  known,  and  is  commonly 
referred  to  as  "failure  mode  and  effect 
analysis"  or  FMEA.  In  current  rotorcraft 
flying  qualities  specifications,  such  as 
ADS33C  (Reference  2),  manufacturers  are 
required  to  list  all  failures  and  their  immediate 
and  subsequent  effects  on  flying  qualities. 

Such  a  FMEA  needs  to  be  comprehensive  and 
correct.  It  also  needs  to  be  usable.  If  all 
initial  failures  are  considered  and  subsequent 
failures  are  not  excluded  the  list  is  long  and 
unwieldy.  It  is  necessary  for  failures  to  be 
categorised,  so  that  the  FMEA  describes  a 
manageable  number  of  'failure  states'  (as 
required  by  ADS33C)  rather  than  just  a  huge 
number  of  individual  failures. 

Initially  the  FMEA  is  theoretical  and  the  stated 
effects  on  flying  qualities  are  predictions. 
Normally,  therefore,  the  FMEA  is  validated  or 
modified  during  development  by  rig  tests  of 
the  system  which  simulate  component  failures 
and  show  what  actually  occurs.  The  rig  tests 
also  allow  attention  to  be  focussed  closely  on 
those  areas  that  the  FMEA  suggests  are 
critical.  Thus  the  analysis  and  rig  tests 
provide  valuable  guidance  before  flight 
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examination  of  critical  aspects.  Flight  test 
remains  essential  since  it  is  not  unusual  -  a 
realist  might  even  say  usual  -  for  flight  results 
to  differ  from  rig  results  because  of  the 
difficulties  of  making  a  completely 
representative  simulation. 

2.2  Frequency  of  Occurrence  of  Failures  and 
of  Failure  States. 

Manufacturers  are  required  by  ADS33C  to 
calculate  the  probability  of  failure  states  being 
encountered.  There  are  two  elements  to  this. 
The  first  is  the  determination  of  frequency  of 
occurrence  of  failures.  The  second  is  analysis 
of  how  often  failures  will  lead  to  particular 
consequences,  since  these  will  depend  on 
external  factors  such  as  speed,  altitude,  visual 
cues,  eg  position  etc.  For  its  calculation  it  is 
necessary  to  know  all  the  relevant  variables 
and  their  frequency  of  occurrence.  The 
number  of  possibilities  can  be  very  large  and, 
as  with  the  FMEA,  classification  of  effects  is 
essential  if  the  predicted  frequency  spectra  are 
to  be  usable. 

Again,  theoretical  estimates  need  to  be  updated 
in  the  light  of  actual  experience,  since  actual 
failure  rates  may  differ  from  those  predicted, 
and  are  liable  to  change  with  time  as  systems 
become  mature  or  as  modifications  are 
introduced. 

2.3  Classification  of  Failures  by  their  Effects. 

The  two  preceding  paragraphs  discuss  failures 
as  they  are  seen  by  the  design  engineer,  who 
sees  a  system  'from  the  inside'.  The  pilot, 
however,  is  primarily  concerned  with  what  the 
system  produces.  This  is  true  not  only  when 
the  system  is  functioning  correctly,  but  also  - 
or  even  especially  -  when  it  goes  wrong.  It 
would  be  very  satisfactory  if  whenever  a 
failure  occurred  it  produced  a  mild  but  clearly 
recognisable  disturbance  to  the  flight  path  so 
that  the  pilot  was  both  aware  of  the  failure  and 
easily  able  to  counter  its  effects.  Although 
many  failures  are  like  this,  the  effects  of  some 
are  so  mild  that  they  are  quite  likely  not  to  be 
noticed  by  the  pilot.  Other  failures  can  occur 
whose  effects  are  severe  enough  to  require 
immediate  reaction  from  the  pilot  to  maintain 
control  of  the  helicopter.  It  is  convenient  to 
classify  the  effects  of  failures  as  being  Mild, 


Moderate  or  Severe,  whose  implications  are 
discussed  below. 

2.3.1  Failures  produciug  Mild  disturbauce. 

If  a  failure  occurs  that  produces  only  a  gradual 
change  in  the  flight  path,  this  does  not 
immediately  hazard  the  helicopter,  but  the  pilot 
should  be  warned  that  such  a  failure  has 
occurred.  The  warning  could  be  of  any 
suitable  type  (eg  visual  or  aural)  provided  that 
the  pilot  gets  the  message  in  adequate  time  to 
avoid  difficulties,  such  as  running  out  of 
height. 

2.3.2  Failures  produciug  Moderate 
disturbauce. 

Here  the  motion  of  the  helicopter  provides  a 
cue  for  the  pilot  and  it  may  well  be 
supplemented  by  other  cues  such  as  instrument 
indications,  engine  or  rotor  noise,  or  even  a 
specific  warning.  Such  failures  are  no  great 
problem  if  the  cues  are  good,  the  flight 
conditions  are  not  too  bad,  and  the  change  of 
flight  path  is  not  immediately  critical,  so  that 
the  pilot  can  avoid  difficult  conditions. 

2.3.3  Failures  produciug  Severe  disturbance. 
Some  failures  can  produce  so  rapid  a 
divergence  that  the  helicopter  can  be  at  risk  in 
a  few  seconds,  or  even  less.  Here  the  pilot 
must  intervene  very  rapidly  to  contain  the 
situation,  and  such  intervention  preferably 
should  not  entail  the  operation  of  cut-outs  or 
switches  that  require  separate  actions.  In  some 
circumstances  the  cues  are  not  conspicuous 
and  the  problem  for  the  pilot  can  lie  in 
recognising  that  a  failure  has  occurred  before  a 
critical  situation  has  developed,  even  if 
dynamic  cues  are  supplemented  by  a  warning 
(this  can  arise,  for  example,  when  the  normal 
operation  of  an  automatic  mode  involves 
coarse  changes  of  aircraft  attitude  such  that  the 
initial  disturbance  resulting  from  an  autopilot 
"runaway"  is  not  obvious).  In  both  these 
instances  the  pilot  intervenes  to  restore  the 
helicopter  initially  to  a  safe  attitude  and  then 
to  a  safe  flight  path.  Sometimes,  it  is 
necessary  to  control  the  flight  path  to  avoid  an 
obstacle,  such  as  the  ground  if  the  helicopter  is 
flying  very  low.  Here  the  closeness  of  the 
ground  can  curtail  the  time  available  for 
successful  intervention. 
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2.3.4  Failures  producing  Delayed 
disturbances. 

These  can  arise  if  a  failure  occurs  within  a 
system  that  does  not  produce  an  immediate 
effect,  but  does  so  later  on  if,  say,  a  second 
failure  occurs,  or  the  system  mode  is  changed. 
(It  should  be  noted  that  while  such  dormant 
failures  must  be  considered  during  design  and 
testing,  from  a  pilot's  viewpoint  they  do  not 
exist  because,  until  the  second  event  occurs, 
there  is  no  change  to  the  aircraft  attitude  or 
flight  path).  Such  dormant  failures,  if  they 
subsequently  produce  a  disturbance,  can  be 
classified  as  above  by  the  severity  of  the 
disturbance,  ie  mild,  moderate  or  major.  A 
failed  warning  system  is  a  dormant  failure  if 
the  pilot  is  unaware  of  it.  This  classification 
of  failures  is  summarised  in  Figure  2. 

2.4  Criteria  of  Acceptability. 

For  the  effects  of  a  particular  system  failure  to 
be  tolerable,  it  must  be  possible  for  the  pilot  to 
recognise  the  failure  in  any  phase  or  condition 
of  flight  in  which  it  can  occur,  and  to  restore 
the  helicopter  to  safe  flight.  The  recovery 
action  should  not  require  exceptional  piloting 
skill  and,  throughout  the  disturbance  and 
recovery,  the  helicopter  should  remain  within 
its  "never  exceed"  limitations  and  clear  of  the 
ground. 

It  is  obviously  essential  that,  following  a 
system  failure,  sufficient  time  is  available  for 
the  pilot  to  recognise  the  effects  of  that  failure 
and  to  initiate  successful  recovery  action.  The 
interval  between  the  failure  and  the  pilot's 
recovery  action  is  commonly  called  the 
'intervention  time'.  For  any  failure  that  can 
lead  to  a  loss  of  control  there  is  an  interval 
after  which  successful  recovery  action  is 
impossible;  this  interval  is  the  'available' 
intervention  time.  Equally  there  is  an  interval 
that  the  pilot  needs  to  recognise  and  initiate 
recovery  action;  this  is  the  'required' 
intervention  time. 

In  flight  testing,  where  precise  measurement  is 
necessary,  it  is  usual  to  define  the  intervention 
time  as  the  interval  between  the  start  of  the 
failure  (usually  the  initial  movement  of  an 
actuator)  and  the  start  of  the  pilot's  action  (the 
first  movement  of  the  control).  This  definition 
has  been  successfully  used  for  many  years. 


although  others  are  possible  and  might  in  some 
circumstances  be  appropriate.  Clearly  for  a 
failure  to  be  judged  to  be  satisfactory  the 
required  intervention  time  must  be  less  than 
the  intervention  time  available.  Figure  3,  a 
very  simple  example,  shows  how  the  'required' 
and  'available'  intervention  times  can  be  used 
to  define  a  limiting  condition,  in  this  case  the 
maximum  speed  at  which  recovery  is  possible. 

2.5  Factors  affecting  Required  and  Available 
Intervention  Times. 

'Required'  and  'available'  intervention  times  are 
affected  principally  by  the  flight  conditions, 
the  aircraft/system  characteristics  and  the  level 
of  attention  that  the  pilot  is  able  to  devote  to 
the  flying  task,  as  indicated  below: 

2.5.1  Flight  Conditions 

*  VFR  V  IFR  -  In  principle,  if  the  visual 
displays  are  adequate,  then  a  failure  in 
instrument  flight  is  similar  to  one  in  visual 
flight.  However,  cockpit  displays  are  seldom 
as  reassuring  as  a  view  of  the  outside  world, 
and  the  process  of  recognition,  diagnosis  and 
recovery  is  often  more  difficult  and  lengthy  in 
instrument  flight. 

*  Level  V  Manoeuvring  Flight  -  A 
failure-caused  perturbation  in  the  flight  path  is 
more  readily  recognised  in  level  flight  than  in 
an  automatic  manoeuvre  that  itself  is  a 
succession  of  perturbations.  Further,  in 
manoeuvres  the  margin  between  safe  and 
unsafe  flight  attitudes  can  he  reduced,  which 
correspondingly  reduces  the  time  available  for 
intervention.  These  aspects  are  summarised  in 
Figure  4. 

*  Airspeed  -  The  intervention  time 
available  is  often  greatly  reduced  at  the  higher 
airspeeds  (but  other  factors  such  as  altitude, 
weight  and  configuration  can  also  have 
significant  effects). 

*  Height  -  Proximity  to  the  ground,  or  to 
other  hazards,  self-evidently  reduces  the 
intervention  time  available. 

2.5.2  Aircraft  and  System  Characteristics 

*  Poor  Stabilisation  -  If  the  flight  path  is 
not  smooth  because  the  stabilization  system 
does  not  work  well,  then  this  delays  the 
recognition  of  failure-caused  perturbations. 
However,  if  the  system  is  so  poor  that  it 
requires  the  pilot  occasionally  to  intervene. 
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then  his  close  monitoring  of  the  system  will  be 
beneficial, 

*  Cue  Quality  -  Clear  cues  shorten  the 
intervention  time  required,  particularly  if  they 
give  an  "instinctive"  indication  of  the  recovery 
action  to  be  taken. 

2.5.3  Piloting  Actions 

*  Pilot  Attention  Level  -  A  pilot  who  is 
attentively  monitoring  system  behaviour  will 
react  more  quickly  than  one  who  is  bored  by 
inaction  or  preoccupied  with  other  tasks. 

*  "Hands  On"  v  'Hands  Off  "  -  Flying 
"hands  on"  shortens  intervention  times,  but 
there  are  often  occasions  when  hands  are 
needed  elsewhere  than  on  the  flying  controls. 

2.6  Acceptable  Risk  Levels. 

Achieved  intervention  times  can  be  very  small 
-  even  effectively  zero  if  the  pilot  is 
manoeuvring  the  helicopter  when  the  failure 
occurs  -  or  many  seconds  if  the  effect  of  the 
failure  is  obscured  by  a  poor  cue  environment. 
ADS33C  for  example  specifies  times  between 
3  and  10  sec.  Since  the  severity  of  a  failure 
depends  upon  the  factors  described  in  para  2,5 
above,  it  is  usually  possible  and  necessary  to 
define  a  flight  envelope  or  set  of  conditions 
within  which  the  helicopter  is  safe  in  the  event 
of  failure.  Outside  this  envelope  there  is  a  risk 
of  disaster  that  increases  with  distance  from 
the  'safe'  area. 

For  example,  a  helicopter  might  be  safe  in  the 
event  of  a  particular  failure  at  speeds  up  to 
120  knots  but  be  subject  to  increasing  risk  at 
higher  speeds.  Careful  examination  of  this  risk 
up  to,  say,  140  knots  may  show  that  it  is  very 
low  when  expressed  as  'accidents  per  flying 
hour'  -  a  figure  of  1  x  10"^  perhaps.  Whilst  it 
is  difficult  to  accept  that  accidents  should  be 
regarded  as  "normal",  nonetheless  the  principle 
has  found  favour  where  the  gain  in  operational 
capability  is  significant.  In  time  of  war,  it  is 
often  desirable  for  tactical  reasons  to  use  the 
maximum  possible  speed  or  the  lowest 
possible  altitude  because  of  the  reduced 
exposure  to  enemy  fire,  and  overall  helicopter 
losses  may  even  be  reduced  despite  a  small 
increase  in  technical  risk. 

With  complex  systems  performing  automatic 
manoeuvres  (or  determining  manoeuvres 


through  a  flight  director)  it  becomes  very 
difficult  to  decide  how  often  a  failure  is  likely 
to  lead  to  disaster.  Whether  it  does  or  not 
depends  on  the  nature  of  the  failure,  the  flight 
conditions  at  the  time,  and  the  required 
intervention  time.  This  latter  depends  heavily 
on  the  pilot's  ability  to  cross-check  between 
what  is  happening  and  what  ought  to  be 
happening  and  hence  to  recognise 
abnormalities. 

Such  complex  situations  can  be  dealt  with  by 
calculation.  The  principle  is  illustrated  in 
Figure  5.  The  FMEA  provides  data  on  the 
distribution  of  possible  defects  and  failures. 

The  operational  flight  spectrum  provides  the 
distribution  of  all  possible  flight  conditions. 

The  helicopter  response  to  any  failure  is 
provided  by  theoretical  computation  supported 
by  flight  test  data.  The  consequent  reaction  of 
the  pilot  can  be  described  by  a  single  (or,  more 
probably,  by  a  distribution  of)  required 
intervention  time(s)  based  on  theoretical 
analysis  and  confirmed  by  flight  test  data. 

Thus  from  any  set  of  initial  conditions  the 
recovery  manoeuvre  can  be  calculated. 

Whether  or  not  this  is  successful  can  be 
determined  by  the  application  of  a  suitable 
crash  criterion  (e.g.  the  helicopter  hits  the 
ground,  or  a  critical  load  is  exceeded). 

Repeated  calculations  from  different  randomly 
selected  initial  conditions  will  enable  an 
overall  figure  to  be  determined  for  the  total 
number  of  survivable  failures  occurring  for 
each  one  that  causes  a  crash.  Separately,  the 
system  reliability  data  can  provide  the 
probability  of  failures  occurring.  These  two 
figures  are  the  terms  of  the  "crash  equation" 
that  enables  the  crash  rate  to  be  calculated, 
namely 

hours  /failure  x  failures  /crash 

=  hours  /crash 

To  apply  this  method  to  a  specific  helicopter 
and  mission,  many  supplernentary  questions 
need  to  be  answered,  but  the  method  has  been 
used  successfully.  In  particular,  it  allows  the 
trade-off  to  be  made  between  operational 
capability  and  risk  level  from  system  failure, 
and  may  show  that  accepting  a  slight  increase 
in  risk  from  system  failure  can  produce  such 
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an  improvement  in  capability  that  overall  risk 
of  loss  in  combat  is  reduced. 

2.7  Current  Requirements  relating  to  System 
Failures. 

Current  requirements  are  numerous,  lengthy 
and  detailed.  Some  subjects,  such  as  flying 
qualities  or  automatic  flight  control  systems 
are  extensively  covered;  others  such  as  cockpit 
displays  are  less  favoured.  The  continuing 
emergence  of  new  technologies  makes  it  very 
difficult  to  keep  specifications  up  to  date,  and 
this  leads  to  their  being  inadequate  in  some 
respects  such  that  it  is  possible  for  a  helicopter 
to  meet  existing  requirements  but  still  be  liable 
to  system  behaviour  or  system  failures  that 
make  it  insufficiently  safe.  When  this  occurs 
the  certification  or  clearance  authority  needs  to 
seek  improvement  to  the  system,  introduce 
special  operating  procedures,  or  restrict  the 
operation  of  the  helicopter  so  that  potentially 
dangerous  situations  are  avoided.  The  Annex 
discusses  principal  current  requirements. 

3.  PROCEDURE  FOR  FLIGHT  TESTING 

(NOTE:  As  stated  in  the  Preface,  this  paper 
seeks  to  deal  with  the  flight  testing  of  any 
flight-safety-critical  system.  While  the 
principles  will  remain  the  same  for  all  systems, 
the  details  of  the  tests  will  depend  upon  the 
particular  system.) 

3.1  Speciflcation  of  the  System. 

For  the  system  to  be  tested  properly  it  is 
essential  that  there  be  a  clear  understanding  of 
what  it  is  supposed  to  do.  This  is  usually 
written  in  the  specification  for  the  system. 

This  might  be  supplemented  by  a  statement  of 
requirement,  which  tends  to  define  an 
operational  need  rather  than  an  engineer's 
solution.  In  particular,  the  required  system 
performance  must  be  stated,  and  the  flight 
envelope  within  which  this  performance  is  to 
be  obtained.  If  the  formal  specification  is 
insufficiently  explicit  it  may  be  necessary,  for 
flight  test  purposes,  to  devise  supplementary 
criteria  for  system  performance  from  rational 
consideration  of  the  intended  operational 
usage. 


3.2  System  Performance  Tests. 

These  tests  will  exercise  the  system  over  the 
relevant  flight  and  environmental  envelopes  to 
see  how  it  behaves.  Its  behaviour  will  be 
regarded  as  satisfactory  if  it  enables  the 
required  performance  to  be  achieved  within  the 
constraints  imposed  by  other  applicable 
requirements,  especially  those  in  respect  of 
flying  qualities.  A  primary  objective  of  this 
work  is  to  see  if  there  are  any  circumstances  in 
which  the  system  performance  is 
unsatisfactory.  If  the  behaviour  is  bad  enough 
it  might  be  necessary  to  preclude  operation  in 
that  condition.  It  is  essential  that  "worst 
cases"  be  examined.  If  an  aft  eg  position  is 
adverse,  some  flying  must  be  done  at  aft  eg. 

If  a  volatile  fuel  is  adverse,  then  try  the 
volatile  fuel.  One,  or  rather  a  few,  words  of 
warning,  however.  It  is  possible  to  stack  up 
adverse  conditions  so  thoroughly,  but 
unreasonably,  that  one  shows  that  the 
helicopter  should  not  fly  at  all.  Worst  cases 
must  be  examined,  but  sensible  judgements 
must  be  made  about  them  based  on  the  overall 
probability  of  the  worst  case  arising. 

3.3  System  Failure  Tests. 

Failures  must  be  tested  in  flight  and  this 
requires  a  method  for  'injecting'  failures  into 
the  system.  Providing  this  facility  is  often 
quite  difficult,  and  it  merits  consideration  at  a 
very  early  stage  in  the  planning  of  a 
programme.  If  the  helicopter  is  to  be  seen  to 
be  safe,  then  the  tests  must  include  the  most 
critical  cases.  However  certain  obvious 
precautions  are  necessary.  It  is  sensible  to 
start  with  easy  cases  and  proceed  progressively 
to  critical  ones.  (Selection  of  the  failures  to  be 
tried  in  flight  will  be  aided  if  an  FMEA  is 
available  and  if  rig  tests  or  simulations  have 
been  done.  This  is  particularly  desirable  in  the 
case  of  complex  systems,  and  can  greatly 
shorten  the  flight  programme.)  The  objective 
of  the  tests  is  to  establish  that  failures  can  be 
survived  when  the  pilot  intervenes  after  a 
realistic  intervention  time,  that  is,  that  the 
intervention  time  required  by  the  pilot  is  less 
than  the  available  intervention  time  imposed 
by  the  system  and  the  circumstances.  A  test 
helicopter  with  dual  pilot  stations  is  highly 
desirable,  and  is  essential  if  the  most  rigorous 
tests  are  to  be  conducted  safely. 


8 


Safety  is  enhanced  in  flight  if  the  pilot  is 
warned  when  the  failure  is  to  be  injected  and, 
in  successive  tests,  consciously  increases  the 
intervention  time.  In  a  progressive  case  it  will 
then  be  possible  to  make  a  good  estimate  of 
the  maximum  intervention  time  available 
without  hazarding  the  helicopter.  As  part  of 
this  process  it  will  be  necessary  to  decide  what 
constitutes  a  safe  recovery,  taking  into  account 
the  general  criteria  of  acceptability  introduced 
in  para  2.4.  In  a  particular  case  a  safe 
recovery  might  be  defined  as  one  in  which  the 
helicopter  does  not  exceed  any  of  its  "never 
exceed"  limits:  in  another,  it  might  be 
determined  by  the  height  lost  during  recovery. 

Determination  of  a  realistic  intervention  time 
required  is  often  difficult  but  may  be  necessary 
if  there  are  no"requirements"  that  are  both 
relevant  and  sound.  For  an  operationally 
representative  required  intervention  time  to  be 
established  in  flight,  the  pilot  must  be  unaware 
that  a  failure  is  to  be  injected,  and  not  be 
untypically  practised  at  recognising  failure 
cues  and  taking  appropriate  control  action.  A 
pilot  who  has  been  engaged  in  a  failure  test 
programme  is  therefore  not  a  good  subject  for 
tests  of  unwarned  failures.  In  practice,  it  is 
necessary  to  conduct  most  of  the  programme 
with  one  or  two  pilots,  gradually  approaching 
critical  cases  and  making  the  best  estimates  of 
available  and  necessary  recovery  times.  When 
this  has  been  done  it  is  then  possible  to  take 
an  unpractised  pilot  and  subject  him  to 
unwarned  tests.  The  safety  pilot  must  be 
completely  familiar  with  the  test  that  is  to  be 
made  and  preferably  should  inject  the  failures. 
The  test  points  must  be  chosen  with  care.  If 
they  are  too  easy  the  results  will  have  little 
value,  if  they  are  too  difficult  the  risk  increases 
and  the  safety  pilot  is  naturally  inclined  to 
intervene.  Such  tests  are  most  relevant  where 
usable  cues  are  not  prominent  and  the 
consequences  of  delayed  intervention  are 
serious,  for  it  is  in  these  circumstances  that 
simulation  most  requires  verification.  This 
will  serve  as  a  check  on  the  estimates  made 
from  the  previous  test  programme. 

3.4  Post  Failure  Peifonnance  Tests. 

Following  a  failure  a  system  is  degraded  and 
this  is  likely  to  appear  as: 

*  degradation  of  system  performance 


*  loss  of  a  particular  function 

*  similar  system  performance  but  a  higher 
susceptibility  in  the  event  of  further  failures. 

If  the  system  performance  is  degraded  then 
operating  close  to  the  extremes  of  the  flight 
envelope  is  likely  to  be  unsatisfactory.  If  a 
function  is  missing  then  the  implications  of 
this  will  need  to  be  considered.  These  cases 
should  be  examined  in  flight,  again 
approaching  critical  conditions  gradually.  If 
the  system  degradation  means  that  the 
helicopter  is  more  vulnerable  in  the  event  of  a 
further  failure,  then  it  may  be  necessary  to 
conduct  appropriate  flight  tests.  It  will 
certainly  be  necessary  to  advise  on  the  best 
course  of  action  in  view  of  the  higher  risk 
level  in  the  degraded  state. 

4.  PRODUCT  OF  THE  FLIGHT  TEST 
PROGRAMME 

The  principal  products  of  the  flight  test 
programme  may  be  summarised  as  follows: 

4.1  Flight  Envelopes. 

Perhaps  the  most  important  outcome  of  the  test 
programme  is  the  investigation  and  subsequent 
definition  of  the  various  flight  envelopes  that 
can  be  adopted  for  Service  use,  namely: 

*  Normal  Operation  -  The  system 
performance  tests  will  determine  the 
performance  of  each  flight-safety-critical 
system,  including  the  effects  on  that 
performance  of  adverse  conditions  (e.g. 
turbulence,  or  high  ambient  temperature),  so 
that  the  flight  envelope  over  which  the 
characteristics  of  all  flight-safety-critical 
systems  remain  satisfactory  can  be  defined. 
Similarly,  the  failure  tests  will  define  the  flight 
envelope  within  which  recovery  is  assured 
from  the  effects  of  any  failure  (or  combination 
of  failures)  whose  probability  of  occurrence  is 
insufficiently  low  to  discount.  By  taking  the 
more  conservative  flight  conditions  indicated 
by  these  two  envelopes,  the  flight  envelope  for 
normal  operation  can  be  derived. 

*  Flight  with  Degraded  System  -  The  tests 
will  indicate  the  advisability  of  curtailing  the 
normal  flight  envelope  following  an  initial 
failure.  If  the  number  of. possible  failures  is 
large  then  it  will  be  necessary  to  exercise  some 


mental  discipline  to  produce  limitations  that 
are  adequate  and  usable. 

*  Flight  Envelope  with  Higher  Risk 
Levels  -  If  it  is  considered  desirable  by  the 
operators  of  the  helicopter,  then  some 
extensions  to  the  permitted  flight  envelope 
could  be  made  with  a  concomitant  reduction  in 
safety.  However,  if  this  is  done  it  is  necessary 
to  be  quite  clear  about  the  nature  or  degree  of 
the  higher  risk  levels,  so  that  intelligent 
judgements  can  be  made  about  their  use. 

4.2  Piloting  Procedures. 

A  satisfactorily-completed  failure  test 
programme  will  yield  realistic  empirical 
evidence  on  both  the  immediate  action  to  be 
taken  when  a  failure  occurs,  and  the 
procedures  to  be  followed  to  identify  the 
nature  of  that  failure  and  the  subsequent 
corrective  action  to  be  taken.  (There  have 
been  cases,  for  instance,  of  single  governor 
failures  on  multi-engine  helicopters  leading  to 
the  shutting  down  of  the  wrong  engine,  which 
simple  procedural  checks  would  have  avoided.) 
This  evidence  will  be  used  to  derive 
comprehensive  but  concise  emergency 
procedures  for  inclusion  in  the  aircrew  manual. 
Moreover,  it  may  lead  to  the  recommendation 
that  pilots  should  experience  failures  in  flight 
as  part  of  their  training. 

4.3  Recommendations  for  System 
Improvements. 

Recommendations  for  improvements  are  the 
inevitable  outcome  of  a  flight  test  programme. 
In  the  testing  of  a  system  that  is  flight  safety 
critical,  it  is  specially  relevant  to  consider  if 
modification  can  improve  the  safety  of  the 
helicopter  operation. 

4.4  Comparison  of  Specified  and  Achieved 
System  Performance. 

For  the  helicopter  and  its  operator  this  is 
probably  the  least  important  product  of  the 
programme.  It  has,  however,  interest  for  the 
manufacturer.  It  determines  whether  he  gets 
paid. 
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Figure  2 
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Figure  4 
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Figure  5 
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ANNEX  1 

Specifications  and  Requirements 


1.  SPECIFICATIONS 

Specifications  normally  exist  for  specific 
systems  and  helicopters.  They  define  what  are 
the  essential  characteristics  of  the  systems  and 
of  the  helicopter  itself.  They  usually  try  to  be 
as  clear  as  possible  in  their  definitions  and 
sometimes  even  specify  precisely  what  test 
must  be  performed  to  demonstrate  compliance. 
However  each  new  specification  covers  areas 
of  technological  or  theoretical  advance,  and 
these  normally  pose  new  problems  in  flight 
testing. 

2.  REQUIREMENTS 

General  requirements  also  exist  for  helicopter 
flying  qualities.  They  have  tended  to  focus  on 
the  characteristics  required  of  flight  control 
systems  (Reference  1).  Recent  standards  have 
extended  their  scope  to  include  cockpit 
displays  and  vision  aids.  The  US  document 
Aeronautical  Design  Standard  33 C  (Reference 
2)  is  comprehensive  and  includes  the  following 
topics  that  are  directly  relevant  to  the  flight 
testing  of  critical  systems. 

2.1  Multiple  Flight  Envelopes. 

The  Operational  envelope  is  that  required  to 
perform  the  mission,  whilst  the  Service 
envelope  is  the  larger  envelope  of  which  the 
helicopter  is  capable. 

2.2  Degraded  Visibility,  Vision  Aids  and 
Displays. 

Tests  are  defined  that  assess  the  Usable  Cue 
Environment  when  using  vision  aids  and 
displays.  The  contractor  is  required  to  define 
manoeuvring  envelopes  for  near-earth 
operation  in  poor  visibility.  The  necessary 
detailed  assumptions  on  pilot  delays  and 
reaction  times  must  be  approved  by  the 
procuring  authority. 

2.3  Failures. 

The  contractor  must  identify  all  failure  states 
which  affect  rotorcraft  response  or  the  usable 
cue  environment.  These  can  then  be  treated  in 
one  of  three  ways: 


*  The  total  probability  of  encountering  a 
specified  moderate  deterioration  in  flying 
qualities  must  not  exceed  specified  values. 

*  Failures  of  the  flight  control  system, 
(and  the  engine(s)  and  electrical  system)  must 
meet  specific  requirements:  for  example,  no 
single  failure  within  the  flight  control  system 
should  cause  dangerous  or  intolerable  flying 
qualities. 

*  Special  Failures:  these  are  failures 
whose  probability  of  occurrence  is  so  remote 
that  they  can,  with  the  agreement  of  the 
procuring  authority,  be  excluded  from  further 
consideration. 

The  requirement  recognises  multiple  failures, 
flight  path  transients  at  failure,  and  degraded 
operation  after  failure.  Pilot  attention  levels 
and  delay  times  are  also  considered. 

2.4  Helicopter  Response. 

The  required  response  to  all  control  inputs  is 
specified. 

2.5  Subjective  Requirements. 

Subjective  terms  are  used  in  the  document, 
but  it  is  required  that  these  be  quantified 
before  contract  initiation. 

3.  RATING  SCALES 

The  Cooper-Harper  scale  (Reference  4)  for 
rating  flying  qualities  is  a  part  of  the 
vocabulary  of  any  flight  tester.  It  is  used 
extensively  in  specification  documents.  A 
similar  approach  has  been  adopted  by  Hindson, 
Eshow  and  Schroeder  (Reference  5)  to  devise 
a  rating  scale  for  failure-induced  flight  path 
transients.  Both  of  these  scales  facilitate 
sensible  discussion  of  flight  tests,  they  do  not 
indicate  how  a  flight  test  programme  should  be 
conducted. 

4.  SUMMARY 

In  summary,  it  can  be  said  that  specifications 
remain  complementary  to  this  document.  They 
provide  a  wealth  of  information  on  system 
performance  characteristics,  and  valuable 
guidance  on  how  to  treat  system  failures.  In 
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the  more  difficult  cases  they  are  unable  to  be 
specific  and  require  these  to  be  either  the 
subject  of  agreement  between  the  contractor 
and  the  procuring  authority,  or  of  definition  by 
the  procuring  authority.  In  either  case  the  wise 
procuring  authority  will  look  to  the  flight  test 
agencies  since  they  are  responsible  for 
ensuring  safety  in  flight. 
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ANNEX  2 

AGARD  Flight  Test  Instrumentation  and  Flight  Test  Techniques  Series 

1.  Volumes  in  the  AGARD  Flight  Test  Instrumentation  Series,  AGARDograph  160 

Publication 
Date 


Volume  Title 

Number 


1.  Basic  Principles  of  Flight  Test  Instrumentation  Engineering  (Issue  2) 

Issue  1:  edited  by  A.  Pool  and  D.  Bosman  1974 

Issue  2:  edited  by  R.  Borek  and  A.  Pool  1994 

2.  In-Flight  Temperature  Measurements 

by  F.  Trenkle  and  M.  Reinhardt  1973 

3.  The  Measurements  of  Fuel  Flow 

by  J.T.  France  1972 

4.  The  Measurements  of  Engine  Rotation  Speed 

by  M.  Vedrunes  1973 

5.  Magnetic  Recording  of  Flight  Test  Data 

by  G.E.  Bennett  1974 

6.  Open  and  Closed  Loop  Accelerometers 

by  1.  Mclaren  1974 

7.  Strain  Gauge  Measurements  on  Aircraft 

by  E.  Kottkamp,  H.  Wilhelm  and  D.  Kohl  1976 

8.  Linear  and  Angular  Position  Measurement  of  Aircraft  Components 

by  J.C.  van  der  Linden  and  H.A.  Mensink  1977 

9.  Aeroelaslic  Flight  Test  Techniques  and  Instrumentation 

by  J.W.G.  van  Nunen  and  G.  Piazzoli  1979 

10.  Helicopter  Right  Test  Instrumentation 

by  K.R.  FerreU  1980 

11.  Pressure  and  Flow  Measurement 

by  W.  Wuest  1980 

12.  Aircraft  Right  Test  Data  Processing  -  A  Review  of  the  State  of  the  Art 

by  L.J.  Smith  and  N.O.  Matthews  1980 

13.  Practical  Aspects  of  Instrumentation  System  Installation 

by  R.W.  Borek  1981 

14.  The  Analysis  of  Random  Data 

by  D.A.  Williams  1981 

15.  Gyroscopic  Instruments  and  their  Application  to  Right  Testing 

by  B.  Stieler  and  H.  Winter  1982 

16.  Trajectory  Measurements  for  Take-off  and  Landing  Test  and  Other  Short-Range  Applications  1985 

by  P.  de  Benque  D’Agut,  H.  Riebeek  and  A.  Pool 

17.  Analogue  Signal  Conditioning  for  Right  Test  Instrumentaticm 

by  D.W.  Veatch  and  R.K.  Bogue  1986 

18.  Microprocessor  Applications  in  Airborne  Right  Test  Instrumentation 

by  M.J.  Prickett  1987 

19.  Digital  Signal  Conditioning  for  Right  Test 

by  G.A.  Bever  1991 
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2. 

Volumes  In  the  AGARD  Flight  Test  Techniques  Series 

Number 

Title 

Publication 

Date 

AG237 

Guide  to  In-Right  Thrust  Measurement  of  Turbojets  and  Fan  Engines  by  the  MIDAP 

Study  Group  (UK) 

1979 

The  remaining  volumes  are  published  as  a  sequence  of  Volume  Numbers  of  AGARDograph  300. 

Volume 

Title 

Publication 

Date 

1. 

Calibration  of  Air-Data  Systems  and  Row  Direction  Sensors 
by  J.A.  Lawford  and  K.R.  Nippress 

1988 

2. 

Identificaticai  of  Dynamic  Systems 
by  R.E.  Maine  and  K.W.  Iliff 

1985 

3. 

Identification  of  Dynamic  Systems  -  Applications  to  Aircraft 

Part  1 :  The  Output  Error  Approach 

by  R.E.  Maine  and  K.W.  Iliff 

1986 

Part  2:  Nonlinear  Analysis  and  Manoeuvre  Design 

by  J.A.  Mulder,  J.K.  Sridhar  and  J.H.  Breeman 

1994 

4. 

Detenu  in  ation  of  Antenna  Patterns  and  Radar  Reflection  Characteristics  of  Aircraft 
by  H.  Bothe  and  D.  McDonald 

1986 

5. 

Store  Separation  Flight  Testing 
by  R.J.  Arnold  and  C.S.  Epstein 

1986 

6. 

Developmental  Airdrop  Testing  Techniques  and  Devices 
by  H.J.  Hunter 

1987 

7. 

Air-to-Air  Radar  Right  Testing 
by  R.E.  Scott 

1992 

8. 
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